TvRMM is building a SOC 2-aligned security readiness program so customers can see how we protect the hosted service today, what we are tightening now, and what evidence we plan to publish as it is approved.
TvRMM is not currently SOC 2 audited. This page is self-attested and provided for transparency; it is not a SOC 2 report, certification, or independent assurance opinion.
Last updated: 2026-07-01. This is the customer-facing status of the readiness program, not an auditor-issued conclusion.
TvRMM already publishes its security model, responsible disclosure path, subprocessor list, DPA, retention policy, and customer-facing support boundaries. The initial SOC 2-aligned governance baseline was approved on 2026-07-01, covering system scope, policy set, control mapping, readiness mapping, and control ownership.
Operating evidence collection remains in progress. The next milestones are access-review evidence, CI and change-management evidence, backup and restore-test evidence, critical-vendor review evidence, tenant-isolation evidence, and incident-response exercise evidence.
As redacted evidence summaries are reviewed and approved for publication, this page will grow into a public trust center with clearer control status and a documented path toward third-party readiness review.
Our readiness work is focused first on Security, Availability, and Confidentiality. The controls below summarize the commitments we are organizing, operating, and evidencing for customer review.
| Control area | Public summary |
|---|---|
| Access control | Production and customer data access are intended to use named accounts, least privilege, MFA where supported, and periodic review. |
| Change management | Product changes are tracked in Git. The app repo uses CI validation, and hosted deployments are explicit operator actions. |
| Tenant isolation | The hosted app is designed around tenant and organization scoping, role-gated actions, and customer-approved support access. |
| Agent identity | Agents enroll into a customer context and use identity material to communicate with the service. |
| Endpoint actions | Scripts, terminal, patching, reboot, updates, cleanup, and remote access are treated as high-risk actions requiring authorization and auditability. |
| Secrets management | Operational secrets are intended to be stored outside source code and loaded into runtime/deploy workflows from approved secret stores. |
| Vulnerability management | Security findings from scans, tests, reviews, and reports are tracked to remediation or documented risk acceptance. |
| Incident response | TvRMM maintains an incident-response process for triage, containment, remediation, customer-impact review, and follow-up. |
| Backup and recovery | Production backup automation exists, and restore-test evidence is part of the readiness roadmap. |
| Vendor management | Providers that process customer data or support production are inventoried and reviewed. |
| Data handling | Retention, export, deletion, and support-access expectations are tracked against public legal/security commitments. |
RMM software has unusual authority over endpoints. Our security program therefore covers both normal SaaS controls and the endpoint-management safeguards customers need to inspect before trusting the service.
TvRMM welcomes good-faith security reports. We ask researchers to report safely, avoid customer data, and stay inside the published research boundaries.
TvRMM asks researchers to allow a reasonable remediation period before public disclosure. A typical target is 90 days from acknowledgement, adjusted for severity and remediation complexity.
TvRMM maintains backup and recovery procedures for the hosted service. We are intentionally careful about this wording until restore tests and recovery targets are documented enough to support stronger public claims.
| Area | Status |
|---|---|
| Production backup automation | Automation is in place for the hosted service and is being folded into readiness evidence. |
| Backup monitoring evidence | Monitoring evidence is being collected and reviewed. |
| Restore-test evidence | Restore-test evidence is the next milestone before stronger recovery claims are appropriate. |
| RTO/RPO targets | Targets will be published only after they are defined, tested, and supportable. |
TvRMM uses providers to host, secure, bill, monitor, deliver, and operate the service. The legal subprocessor page remains the policy source; this summary explains the same provider landscape in the context of security readiness.
| Provider | Purpose | Data involved |
|---|---|---|
| OVHCloud / OVH Proxmox and shared edge infrastructure | Hosted portal, agent check-in services, compute, storage, database, networking, package/installer hosting, monitoring, static website/help site, and public edge delivery. | Customer tenant data, endpoint data, operational records, logs, billing metadata, service telemetry, website request metadata, and release/download metadata. |
| Stripe | Checkout, payment processing, customer portal, invoices, refunds, payment status, and billing webhooks. | Billing metadata, payment status, customer identifiers, invoice and refund records. Stripe handles payment method details directly. |
| Cloudflare | DNS, domain security, edge routing, and email/contact routing where used. | DNS/routing metadata, security logs, and contact-routing metadata where applicable. |
| GitHub | Source control, issue/PR workflow, release automation, and CI/CD operations. | Source code, deployment metadata, operational artifacts, and issue/support context when intentionally added. |
| vanRoojen LLC operated analytics | Privacy-conscious product-site analytics. | Page views, referrers, device/browser metadata, and approximate analytics data. |
This roadmap shows the path from current self-attested readiness work toward a more evidence-backed trust center and, later, a possible third-party readiness review or formal SOC 2 audit path.
| Future audit path |
|---|
| third-party readiness assessment |
| SOC 2 Type 1 |
| SOC 2 Type 2 after an observation period |
Redacted evidence summaries will appear here only after they are reviewed and approved for public release. We will not publish raw logs, customer names, secret values, non-public operations details, or unredacted screenshots.
| Evidence ID | Control area | Public status | Summary location | Last reviewed |
|---|---|---|---|---|
| EVID-2026-07-01-003 | Governance baseline | Published | Initial SOC 2-aligned system scope, policy set, control matrix, readiness mapping, and control-owner model approved on 2026-07-01. This is governance design evidence, not operating-effectiveness evidence or independent audit evidence. | 2026-07-01 |
We want this page to be useful for customer due diligence without overstating where the program is today.
TvRMM is not currently SOC 2 audited. Nothing on this page should be read as a SOC 2 report, certification, or independent assurance opinion.
This page is TvRMM explaining its own current security readiness work in public, using only material approved for public sharing.
The goal is to keep public claims matched to implementation and evidence, then publish redacted support where it is safe and useful for customers.